Looking back through all the vulnerabilities announced this week, one caught my eye. CVE-2016-6366 is a vulnerability in the Cisco ASA products which could allow a remote attacker to remotely execute code. This vulnerability is part of the Equation Group disclosures and was not previously known by Cisco.The vulnerability is in the SNMP code on the ASA and would allow an attacker with knowledge of the SNMP community stringto send craftedIPv4SNMP traffic which could be used to reload the system or possibly exploit the system to gain control.
The likelihood of being able to exploit this is low for those of us who have deployed in a secure manner:
- management interfaces not exposed to hostile networks
- SNMP strings set to a secure value (non-default!)
- etc.
But for those of you who have needed to deploy Cisco ASA in a less than optimal configuration, you may want to keep an eye on this one.
As always the answer is patch soon!
There is a snort rule to detect the attempted exploitation of this vulnerability (Snort Rule ID:3:39885).
SeeCCIRCor Ciscos announcementfor more details
-- Rick Wanner MSISE - rwanner at isc dot sans dot edu - http://namedeplume.blogspot.com/ - Twitter:namedeplume (Protected)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.